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DoD Financial and Feeder Systems Compliance Process 
Executive Summary 


Introduction. The Federal Financial Management Improvement Act of 1996 mandates 
that financial management systems comply with Federal financial system requirements, 
Federal accounting standards, and the U.S. Standard General Ledger at the transaction 
level. Within DoD, those three mandates are generally referred to as Federal financial 
management systems requirements. In January 2001, DoD identified 187 critical 
systems and initiatives, and estimated that it will cost approximately $3.7 billion to 
correct system deficiencies and result in systems that are compliant with Federal 
financial management systems requirements. 

On January 5, 2001, the Under Secretary of Defense (Comptroller) issued a 
memorandum formally approving the DoD Financial and Feeder Systems Compliance 
Process for implementation within the DoD. The DoD Financial and Feeder Systems 
Compliance Process goal is to ensure compliance with applicable Federal financial 
management systems requirements and enhance system’s capabilities to provide timely 
and accurate financial data to senior DoD managers to aid decision making. On 
July 19, 2001, the Secretary of Defense established the DoD Financial Management 
Modernization Program and identified reliable and timely financial management 
information to make effective business decisions as one of his highest priorities. Under 
this direction, a DoD-wide blue print will be developed that prescribes how DoD 
financial and non-financial feeder systems will interact. The National Defense 
Authorization Act for FY 2002 mandates that DoD establish a DoD financial and feeder 
systems compliance process and the Financial Management Modernization Executive 
Committee. The Under Secretary of Defense (Comptroller) issued a memorandum on 
October 12, 2001, to formally establish this Financial Management Modernization 
Executive Committee to oversee the modernization effort. This committee will also 
provide oversight to the DoD Financial and Feeder Systems Compliance Process. 

Objectives. Our objective was to determine the effectiveness of the DoD Financial and 
Feeder Systems Compliance Process to address compliance with applicable Federal 
financial management systems requirements. Specifically, we determined whether the 
DoD Financial and Feeder Systems Compliance Process would achieve compliance of 
both individual and integrated systems. 

Results. The DoD Financial and Feeder Systems Compliance Process had not been 
fully implemented throughout DoD. The Air Force and the Defense Finance and 
Accounting Service had completed substantial work in implementing their own 
Year 2000-like compliance processes. However, the Army, Navy, Air Force, Defense 
Finance and Accounting Service, Defense Logistics Agency, and 12 Other Defense 



organizations needed to do more work toward implementing the DoD Financial and 
Feeder Systems Compliance Process. The Army, Navy, Air Force, Defense Finance 
and Accounting Service, and Defense Logistics Agency: 

• had started but had not completed data mapping, and 

• had not completed a critical inventory list. 

The Army, Navy, Air Force, and Defense Finance and Accounting Service had issued 
guidance. We contacted nine Other Defense Organizations outside the DoD 
Intelligence community and three inside the DoD Intelligence community. Of the nine 
Other Defense Organizations, personnel from four were not aware of the DoD 
Financial and Feeder Systems Compliance Process, and five stated that their agency 
was aware of the memo, but only one stated that the memo had been implemented. 

This occurred because the Under Secretary of Defense (Comptroller) did not have 
sufficient authority over the Military Departments and Defense agencies to effectively 
implement the DoD Compliance Process. As a result, progress toward attaining 
compliance with Federal and DoD financial management systems requirements had 
been slow, although new legislation for FY 2002 and DoD initiatives are intended to 
provide more effective management oversight in the future. For details of the audit 
results, see the Finding section of this report. 

Summary of Recommendations. We recommend that the Under Secretary of Defense 
(Comptroller) institutionalize the compliance process established under the National 
Defense Authorization Act for FY 2002 in an appropriate DoD issuance. We also 
recommend the Under Secretary of Defense (Comptroller) establish and implement 
mechanisms to appropriately monitor the compliance process established under the 
National Defense Authorization Act for FY 2002. Additionally, we recommend that 
the Under Secretary of Defense (Comptroller) provide a clear definition of criticality 
and ensure that adequate guidance for compliance of commercial software is provided. 
We recommend that the Director, Defense Finance and Accounting Service provide 
detailed coverage of requirements for data standardization and general controls in “A 
Guide to Federal Requirements for Financial Management Systems.” 

Management Comments. The Acting Deputy Chief Financial Officer, Office of the 
Under Secretary of Defense (Comptroller) agreed to formalize the Compliance Process 
in a DoD issuance, establish a data repository to monitor the Compliance Process, and 
provide the appropriate scope and language for the systems certification. The Office of 
the Under Secretary partially concurred to providing a clear definition of criticality. 

The Office of the Under Secretary also agreed to provide commercial software 
guidance. The Director of Systems Integration, Defense Finance and Accounting 
Service stated that they will provide detailed coverage of data standardization and 
general control requirements in “A Guide to Federal Requirements for Financial 
Management Systems.” A discussion of the management comments is in the Finding 
section of the report, and the complete text is in the Management Comments section. 

Audit Response. The Under Secretary of Defense (Comptroller) and the Director of 
Systems Integration, Defense Finance and Accounting Service were responsive to the 
recommendations. Therefore, no further comments are required. 
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Background 


This audit was conducted pursuant to the responsibility of the Inspector General, 
DoD, under the Federal Financial Management Improvement Act of 1996 to 
assess the progress made toward substantial system compliance with applicable 
guidelines and standards. This report discusses the effectiveness of the DoD 
Financial and Feeder Systems Compliance Process (DoD Compliance Process). 

History of DoD Financial Management Systems. DoD has had long standing 
financial management problems chronicled by the General Accounting Office 
(GAO) and Inspector General, DoD, audit reports that document systemic 
system deficiencies. DoD acknowledged that their financial management 
systems are flawed with decade-old problems and lack the capability to provide 
reliable and timely information to DoD decision-makers. Also, DoD 
acknowledged that most systems do not comply with Federal financial 
management systems requirements. 

Responsibility for DoD Financial Management Systems. The Under 
Secretary of Defense (Comptroller) [USD (C)] is responsible for the 
development, oversight, and implementation of DoD financial reporting policy. 
The Defense Finance and Accounting Service (DFAS), under the authority of 
the USD (C), owns and operates 56 of the DoD accounting and finance systems 
and initiatives identified in the FY 2000 Financial Management Improvement 
Plan (FMIP). DFAS is responsible for implementing, modifying, and 
maintaining those systems. DFAS is also responsible for providing the Military 
Departments and Defense agencies (DoD Components) with consultative 
guidance and is jointly responsible for ensuring that DoD Component systems 
interact effectively with DFAS systems. DoD Components are responsible for 
implementing, modifying, and maintaining the feeder systems that provide 
significant amounts of data to the DFAS systems. 

DoD Financial and Feeder System Compliance Process. In 2000, the Office 
of Under Secretary of Defense (Comptroller) [OUSD (C)] began efforts to 
institute a Year 2000-like management approach to the DoD Compliance 
Process 1 . On January 5, 2001, the USD (C) issued a memorandum formally 
approving the DoD Compliance Process for implementation within DoD. The 
DoD Compliance Process goal is to ensure that critical financial and feeder 
systems are compliant with applicable Federal financial management systems 
requirements. The DoD Compliance Process will enhance the system’s 
capabilities to provide timely and accurate financial data to aid decision making. 
The DoD Compliance Process also identifies individual roles and responsibilities 
of the Senior Financial Management Oversight Council (Council) and DoD 
Components. 


'Inspector General, DoD, Report No. D-2001-175, “Application of Year 2000 Lessons Learned,” 
August 22, 2001. 
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Senior Financial Management Oversight Council. The memorandum 
formally approved and established the Council as the governing body of the 
DoD Compliance Process. The memorandum also establishes the USD (C) as 
Council Chair, Council membership, and its responsibilities, to include 
overseeing a working group and verifying that exit criteria for each system has 
been completed. 

DoD Components. DoD Components are responsible for ensuring that 
their systems comply with applicable Federal and DoD financial management 
requirements. DoD Components shall implement the five phases of the DoD 
Compliance Process and develop corresponding funding plans for each critical 
accounting, finance and feeder system. DoD Components are also responsible 
for obtaining independent system validations from the Inspector General, DoD; 
a consulting firm; or their respective audit agency. 

The Five Phases. The DoD Compliance Process (modeled after the Year 2000 
process) consists of five phases with defined exit criteria. The five phases are 
Awareness, Evaluation, Renovation, Validation, and Compliance. The defined 
exit criteria should be met before a system can advance from one phase to the 
next. The DoD Compliance Process states that the DFAS "A Guide to Federal 
Requirements for Financial Management Systems 2 " (Blue Book) shall be the 
guidance a system is evaluated against prior to entering the next phase. See 
Appendix B for a detailed discussion of the five phases of the DoD 
Compliance Process. 

Blue Book. The DoD Compliance Process establishes the Blue Book as the 
primary source of guidance in determining system compliance. The Blue Book 
is an extensive compilation of Federal and DoD requirements applicable to the 
DoD finance, accounting and feeder systems. The Blue Book contains 
numerous requirements issued by Office of Management and Budget (OMB), 
GAO, Department of Treasury, Joint Financial Management Improvement 
Program (JFMIP), and DoD. The Blue Book is organized into 15 major 
categories of requirements including general ledger, financial reporting, 
inventory, and travel. As such, the Blue Book is a valuable guide that can be 
used to assist systems managers in determining whether their systems 
substantially comply with Federal financial management systems requirements. 

DoD Financial Management Modernization Program. On June 27, 2001, 
DoD requested $100 million of FY 2002 funds for the development of a DoD- 
wide management systems enterprise architecture and the definition of standard 
data requirements. On July 19, 2001, the Secretary of Defense issued a 
memorandum establishing the DoD Financial Management Modernization 
Program. The requested $100 million is to fund the DoD Financial 
Management Modernization Program efforts. The USD (C) in coordination 
with the Under Secretary of Defense for Acquisition, Technology, and Logistics 
and the Chief Information Officer shall provide policy and oversee the execution 
of the program. The Program Management Office will develop a DoD-wide 
blue print, an enterprise architecture, which prescribes how DoD financial and 


2 Version 3, June 2001. 
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non-financial feeder systems will interact. The DoD Components shall be 
accountable to the Secretary of Defense for the results of their business 
operations and their financial management systems 

Financial Management Modernization Executive Committee. On 

October 2, 2001, the Federal bill, S.1438 as passed by the Senate, authorized 
appropriations for military activities for FY 2002. The S.1438 section 1007 
mandated the establishment of a Financial Management Modernization 
Executive Committee to establish a financial and feeder systems compliance 
process. Subsequently, on October 12, 2001, the USD (C) issued a 
memorandum formally establishing the Financial Management Modernization 
Executive Committee as specified in the July 19, 2001, Secretary of Defense 
memorandum. The Financial Management Modernization Executive Committee 
charter supercedes the Senior Financial Management Oversight Council charter. 

On December 28, 2001, Federal Bill S.1438 was signed into law as the National 
Defense Authorization Act for FY 2002. The National Defense Authorization 
Act for FY 2002 mandates that DoD establish the Financial Management 
Modernization Executive Committee. This committee shall establish a financial 
and feeder systems compliance process (Authorization Act Compliance 
Process). Additionally, this committee should develop, monitor, and supervise 
a management plan for implementing the Authorization Act Compliance 
Process. In addition, this committee must ensure the development and 
maintenance of a DoD enterprise architecture in conjunction with the 
compliance process efforts. This committee will be accountable to the Senior 
Executive Council that includes, among others, the Secretary and Deputy 
Secretary of Defense. 

Financial Management Improvement Plan. In January 2001, the USD (C) 
issued the FMIP to meet the requirements of the National Defense Authorization 
Act for FY 1998. The FMIP identifies DoD critical financial systems and 
initiatives intended to improve the financial data provided by critical feeder 
systems, such as, the DoD Compliance Process. The DoD owns one critical 
system initiative reported in the FMIP. The Army, Navy, Air Force, DFAS, 
Defense Logistics Agency (DLA), and Other Defense Organizations (ODO) own 
24, 34, 46, 57, 9, and 16 systems and initiatives reported in the FMIP, 
respectively. According to the FMIP, it will cost approximately $3.7 billion to 
make the critical systems compliant by 2003. 

Objectives 


Our overall objective was to determine the effectiveness of the DoD Financial 
and Feeder Systems Compliance Process to address compliance with applicable 
Federal financial management systems requirements. Specifically, the objective 
was to determine whether the DoD Financial and Feeder Systems Compliance 
Process would achieve compliance of both individual and integrated systems. 
See Appendix A for a discussion of the audit scope and methodology and prior 
coverage related to the audit objectives. 
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Status of the DoD Financial and Feeder 
Systems Compliance Process 

The DoD Financial and Feeder Systems Compliance Process had not 
been fully implemented throughout DoD. The Air Force and the DFAS 
had completed substantial work in implementing their own 
Year 2000-like compliance processes. However, the Army, Navy, 

Air Force, DFAS, DLA, and 12 ODOs needed to do more work toward 
implementing the DoD Compliance Process. This occurred because the 
USD (C): 

• had not addressed other initiatives that logically should be 
completed prior to the successful implementation of a 
compliance process, 

• did not have sufficient authority over DoD Components to 
effectively implement a compliance process, 

• did not have the mechanisms in place to adequately monitor a 
compliance process implementation, and 

• had not established sufficient guidance to ensure adequate 
reviews of financial management systems are performed. 

Additionally, some DoD Components had shown a lack of initiative in 
implementing the DoD Financial and Feeder Systems Compliance 
Process. As a result, progress toward attaining compliance with Federal 
and DoD financial management systems requirements had been slow, 
although new legislation and DoD initiatives are intended to provide 
more effective management oversight in the future. 

National Defense Authorization Act for FY 2002 

The enactment of the National Defense Authorization Act for FY 2002 
establishes a DoD financial and feeder systems compliance process 
(Authorization Act Compliance Process) as law and will supercede the prior 
DoD Compliance Process. This report focuses on the issues identified during 
our audit of the DoD Compliance Process. Those issues should be addressed in 
the development and implementation of the Authorization Act Compliance 
Process. 

DoD Compliance Process Status 


The DoD Compliance Process had not been implemented throughout DoD. In 
January 2001, DoD identified 187 critical systems and initiatives. DoD 
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estimated that it will cost approximately $3.7 billion to correct system 
deficiencies and result in systems compliant with Federal financial management 
systems requirements. The Army, Navy, Air Force, DFAS, and DLA: 

• had started but had not completed data mapping, and 

• had not completed a critical inventory list. 

The Army, Navy, Air Force, and DFAS had issued guidance. Data mapping, a 
complete critical inventory list, and guidance are key to the successful 
implementation of a compliance process. The USD (C), GAO, and Inspector 
General, DoD, consider data mapping to be an important step in a compliance 
process. Although data mapping is not a specific exit criteria, it is the logical 
starting place to verify that a complete critical inventory list can be identified. 
Data mapping is documenting the flow of financial information from point of 
original entry to eventual reporting on the financial statements. Data mapping 
should be completed early in the DoD Compliance Process to verify that all 
critical and non-critical systems involved in the flow of data from transaction 
origination to presentation on the financial statements can be identified. Data 
mapping also helps verify that DoD Components have appropriately identified 
and considered sources of financial information and their impact on overall data 
accuracy. Following the completion of data mapping, a DoD Component will 
be able to establish a complete critical inventory list, the first exit criteria in the 
Awareness phase. Additionally, DoD Components that issued guidance had 
progressed further in implementing a compliance process than those DoD 
Components that have not. 

The Navy, Air Force, and DFAS had independently established their own 
Year 2000-like processes for determining compliance with Federal financial 
management system requirements prior to the development of the DoD 
Compliance Process. The Air Force and DFAS had completed substantial work 
in implementing their respective Year 2000-like compliance processes. 

However, the Army, Navy, Air Force, DFAS, DLA, and the 12 ODOs 
contacted needed to do more work toward implementing the DoD Compliance 
Process because none of those DoD Components have completed data mapping 
or a critical inventory list. 

DoD Component status and key measures of success for implementing a 
compliance process are presented in the table below. 


Compliance Process Measures 


Air 


Key Measures 

Force 

DFAS 

Army 

Navy 

DLA 

Started data mapping systems 

Yes 

Yes 

Yes 

Yes 

Yes 

Completed data mapping systems 

No 

No 

No 

No 

No 

Completed critical inventory list 

No 

No 

No 

No 

No 

Issued guidance 

Yes 

Yes 

Yes 

Yes 

No 


5 








Air Force. Air Force completed substantial work in implementing its 
Year 2000-like compliance process prior to the development of the DoD 
Compliance Process. The Air Force reported its critical inventory list to include 
23 legacy, 21 ongoing, and 6 systems under development. However, the 
Air Force did not complete data mapping. Until Air Force has completed data 
mapping, the critical systems list may not be all-inclusive. 

The Air Force issued guidance for achieving system compliance with Federal 
financial management system requirements and established individual milestones 
for its systems with the overall milestone of September 2003. The Air Force 
categorized each system into one of five Air Force phases. The five Air Force 
phases are awareness, evaluation, renovation, validation, and compliance. The 
Air Force process varies from DoD because the Air Force does not certify 
substantial compliance of a system until successful completion of a validation 
audit. The DoD Compliance Process requires certification of the system prior 
to the request for validation. The Air Force should coordinate with the 
OUSD (C) to address the differences in the two processes to avoid confusion 
regarding which process they are referring to. 

The Air Force progress to achieve compliance can be partially attributed to the 
implementation of a team to oversee their process, Air Force Audit Agency or 
contractor 3 assistance, a reporting tool to track systems progress, and briefings 
keeping management informed. The Air Force is using the Blue Book as 
guidance to determine compliance with the Federal financial management 
systems requirements and supplemented the Blue Book with specific 
requirements for system controls. The Air Force also established a web-based 
encyclopedia containing system information that includes interfaces, feeder 
systems, migration paths, and infrastructure. The Air Force is reporting 
three systems in its validation phase. Air Force Audit Agency is performing 
two of the validation audits and has contracted out the third. 

Defense Finance and Accounting Service. DFAS completed substantial work 
in implementing its own Year 2000-like process prior to the development of the 
DoD Compliance Process. DFAS is responsible for the compliance of 
20 DFAS systems and jointly responsible for 3 other systems within DoD. 
However, DFAS did not complete data mapping. Until DFAS has completed 
data mapping, the critical systems list may not be all-inclusive. 

In July 1998, DFAS developed guidance to determine compliance of its critical 
systems with Federal financial management system requirements. The DFAS 
process evolved into five phases and was commonly referred to as the DFAS 
Compliance Assessment Methodology. The five DFAS phases were awareness, 
evaluation, renovation, validation, and compliance. In May 2001, DFAS 
formally established the Systems Compliance Review Board Charter to review 


3 The Air Force contracted with Grant Thornton and Associates to map its feeder systems to its general 
fund balance sheet line items. The Air Force also contracted with Logicon to assist in the identification 
of its financial systems inventory. 
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systems compliance and recommend certification to the DFAS Director. Within 
the charter, DFAS included an outline of the revised DFAS Compliance Process 
that was updated to be in alignment with the DoD Compliance Process. 

The DFAS progress to achieve compliance can be partially attributed to the use 
of a spreadsheet to track its systems status, checkpoints 4 , points of contact, and 
milestones for each system. The DFAS Test Integration Data Repository 
maintains requirement profiles, test scripts and results, data collection plans, 
and is accessible via the World Wide Web. Additionally, DFAS contracted with 
KPMG Consulting and Arthur Andersen LLP to provide assistance in 
performing compliance assessments. Management is also provided monthly 
briefings on DFAS system efforts. As of May 2001, the DFAS Director issued 
a memorandum to the Council certifying that one system, Defense Industrial 
Financial Management System, is compliant. DFAS set an overall milestone 
of FY 2003 for its systems to be certified compliant. 

Army. The Army did not independently establish a Year 2000-like process for 
achieving compliance with Federal financial management systems requirements. 
The Army initiated data mapping and compiled a list of critical systems for 
submission to the FMIP. However, Army personnel stated that mapping efforts 
were halted because the process was considered time consuming and would 
require an extensive use of resources. Until the Army has completed data 
mapping, the critical inventory list may not be all-inclusive. 

On May 17, 2001, the Army Audit Agency and the Office of the Deputy 
Assistant Secretary of the Army (Financial Operations) entered into a 
memorandum of agreement defining their responsibilities for each phase of the 
DoD Compliance Process. On June 21, 2001, the Army issued memorandums 
to its components to provide awareness of the DoD Compliance Process and to 
identify 13 of its critical systems. The memorandums also identified the Army 
Audit Agency as the independent validation provider. The Chief Information 
Officer Executive Board was identified as the senior body to address Army-wide 
compliance issues. Army personnel reported that the Corps of Engineers 
Financial Management System was ready for validation. 

Navy. The Navy established a Year 2000-like process that incorporates several 
initiatives to include: 

• Office of Secretary of Defense Implementation Strategies, 

• business process reengineering, and 

• compliance with Federal financial management systems 
requirements. 

The Navy plans to transition this process to coincide with the DoD Compliance 
Process but did not provide a milestone for this transition. The Navy 


4 Checkpoints outline the DFAS compliance assessment process and are steps to be completed that identify 
the responsible organization, associated deliverables, and recipients of those deliverables. 
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established 13 non-financial feeder teams, including representatives from 
various audit agencies, 11 of which were aligned with the Office of Secretary of 
Defense Implementation Strategies. The 13 non-financial feeder teams were 
established to review Navy business practices and streamline those processes 
and to achieve compliance with Federal financial management systems 
requirements. We were unable to determine the success of those efforts to 
achieve compliance with Federal financial management systems requirements. 
On February 14, 2001, the Navy issued a memorandum to establish an 
awareness of the DoD Compliance Process. On February 23, 2001, the Navy 
also issued a memorandum requesting a complete systems inventory by each 
major command. According to Navy personnel, this effort has been 
substantially completed. The Navy did not report that any systems were ready 
for validation. 

Defense Logistics Agency. In January 2001, DLA issued a memorandum 
proposing a strategy to implement the DoD Compliance Process. However, no 
DLA implementation guidance had been issued. DLA did not complete data 
mapping or its critical inventory list. DLA personnel stated that a critical 
inventory list was submitted for the FMIP. However, the list did not include 
systems that would be critical according to the DoD Compliance Process. DLA 
is working with their contractor, Deloitte and Touche, to identify critical 
financial and feeder systems but is focusing its efforts on the business system 
modernization initiative. This initiative will replace many existing DLA 
systems and is intended to correct financial management deficiencies that exist 
within its business area. DLA did not report any systems ready for validation. 

Other Defense Organizations. The sample of nine ODOs outside the DoD 
Intelligence community and three inside the DoD Intelligence community have 
made minimal progress in implementing the DoD Compliance Process. We 
contacted nine ODOs, outside of the DoD Intelligence community, to determine 
whether they were aware of the DoD Compliance Process. Five ODOs had 
DoD imposed reporting requirements, and seven ODOs list systems ownership 
in the FMIP. Of the personnel contacted from the nine ODOs, four were not 
aware of the DoD Compliance Process, and five stated that their agency was 
aware of the memo, but only one stated that the memo had been implemented. 
For details of the specific ODOs, see Appendix C of this report. 

Additionally, we contacted three ODOs within the DoD Intelligence community. 
Two of those DoD Intelligence agencies list ownership of one critical system in 
the FMIP. Personnel from the National Imagery and Mapping Agency, which 
reports ownership of one critical system in the FMIP, were not aware of the 
DoD Compliance Process. The two additional DoD Intelligence agencies need 
to do more work toward implementing the DoD Compliance Process. 

However, we do not discuss details of the results of these two DoD Intelligence 
agencies because the information is classified. 
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DoD Compliance Process Issues 


DoD acknowledges that flaws still exist within its financial management 
framework. Although the implementation of a compliance process should 
resolve some of those problems, the success of the DoD Compliance Process 
had been affected by other factors. Specifically, the USD (C): 

• had not addressed other initiatives that logically should be completed 
prior to the successful implementation of a compliance process, 

• did not have sufficient authority over DoD Components to effectively 
implement a compliance process, 

• did not have the mechanisms in place to adequately monitor a 
compliance process implementation, and 

• had not established sufficient guidance to ensure adequate reviews of 
financial management systems are performed. 

Other Initiatives. The January 5, 2001, memorandum acknowledges that DoD 
Components must execute the DoD Compliance Process in concert with other 
initiatives. However, some of those initiatives logically precede the effective 
implementation of a compliance process and include systems integration and 
standardization efforts and the DoD-wide enterprise architecture. 

Friedman Report. The Secretary of Defense contracted with the 
Institute for Defense Analyses to conduct a study and recommend a strategy for 
financial improvements within DoD. The study resulted in the report 
“Transforming Department of Defense Financial Management, a Strategy for 
Change,” April 13, 2001, also known as the Friedman Report. The report 
indicated that many positive projects are underway within DoD. However, 
those projects are narrow in focus, have insufficient leadership, and are not part 
of an overall integrated DoD-wide strategy. The report recommended a 
structural change within the DoD financial framework by developing standard 
integrated systems and mandating the standardization of finance, accounting and 
feeder systems. The July 19, 2001, Secretary of Defense memorandum; the 
October 12, 2001, USD (C) memorandum; and the National Defense 
Authorization Act for FY 2002 have addressed some of the Friedman report 
recommendations. 

Enterprise Architecture. GAO reported 5 that DoD does not have a 
DoD-wide financial management enterprise architecture. An enterprise 
architecture provides an operational and technological view of an organization’s 
current and targeted environment. The enterprise architecture also provides a 
roadmap between the two environments. GAO recommended that DoD 
immediately designate DoD financial management modernization as a 


5 GAO Report 01-525, Information Technology, Architecture Needed to Guide Modernization of DOD’s 
Financial Operations, May 17, 2001. 
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departmental priority and implement an enterprise architecture. On 
June 27, 2001, DoD requested $100 million for development of a DoD-wide 
management systems enterprise architecture. On July 19, 2001, the Secretary of 
Defense established the DoD Financial Management Modernization Program to 
develop a DoD-wide blue print (an enterprise architecture) that prescribes how 
DoD financial and non-financial feeder systems will interact. Subsequently, on 
October 12, 2001, the USD (C) issued a memorandum establishing the Financial 
Management Modernization Executive Committee as the advisory body to the 
USD (C) for financial management modernization. Additionally, on 
November 29, 2001, a Request for Quotations was issued for the development 
of a DoD-wide Financial Management Enterprise Architecture for the 
OUSD (C). 

Direct Authority. The USD (C) did not have sufficient authority to effectively 
implement the DoD Compliance"Process. GAO reported 6 that DoD Components 
have been directed to follow USD (C) guidance. However, USD (C), as the 
Council Chair, lacked authority over the DoD Component feeder systems. 

Three later actions, the July 19, 2001, Secretary of Defense memorandum; the 
October 12, 2001, USD (C) memorandum; and the National Defense 
Authorization Act for FY 2002 have largely addressed GAO concerns. 

The July 19, 2001, the Secretary of Defense memorandum established the DoD 
Financial Management Modernization Program, giving the USD (C) 
responsibility for the overall direction of financial management reform within 
DoD. Additionally, the memorandum established a Program Management 
Office that shall report to the USD (C). The memorandum also states that DoD 
Components will be accountable to the Secretary of Defense for the results of 
their business operations and their financial management systems. On 
October 2, 2001, the Senate passed, the Federal Bill, S.1438 mandating the 
establishment of the Financial Management Modernization Executive Committee 
with the USD (C) as its chair. The Committee will be accountable to the Senior 
Executive Council that includes the Secretary and Deputy Secretary of Defense. 
The Committee’s accountability to the Senior Executive Council should also 
alleviate most of the GAO concerns on the USD (C) lack of authority over DoD 
Components. Anticipating that the Senate provision would become law, the 
USD (C) issued the October 12, 2001, memorandum formally establishing the 
Committee and superceding the Council. On December 28, 2001, the Federal 
Bill, S.1438 was signed into law as the National Defense Authorization Act for 
FY 2002. However, establishing the Authorization Act Compliance Process in 
a DoD issuance should also provide the authority necessary for implementation. 

Monitoring a Compliance Process. USD (C) did not have the mechanisms in 
place to adequately monitor the implementation of a compliance process. 
Specifically, the USD (C) had not implemented a systems database, and DoD 
Components have requested information on its status to track other systems not 


6 GAO Report 01-525, Information Technology, “Architecture Needed to Guide Modernization of DOD’s 
Financial Operations,” May 17, 2001. 
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within their purview. The USD (C) had also not defined the appropriate 
language for a DoD Component to certify system compliance and verify 
consistency in the scope of a system certification. 

Systems Database. USD (C) personnel stated that a data call will be 
requested from DoD Components to populate a system database with 
information such as system status, milestones, interfaces, and funding. The 
database is intended to blend information reporting requirements and track 
systems in their progress. Until the system database is populated, the USD (C) 
will not be able to monitor and control systems progressing through each of the 
five phases. 

DoD Components also remain unaware of the compliance status for systems not 
in their purview, but affecting their business area. For example, the Standard 
Procurement System and the Defense Travel System will impact the compliance 
of other DoD Component business areas. However, the compliance status of 
those systems is unknown to some DoD Components. Overall, compliance for a 
business area cannot be determined until all systems composing the business 
area are compliant. Once the systems database is available, DoD Components 
should have access to the compliance status of other DoD systems that affect 
their business areas. 

Certification. The USD (C) had not defined appropriate language for a 
system certification to be submitted as part of the Renovation phase exit criteria. 
The DoD Compliance Process goal is to ensure that financial and feeder systems 
(both from a single systems and integrated systems perspectives) comply with 
Federal financial management systems requirements. However, the DoD 
Compliance Process Renovation phase requires DoD Components to certify that 
their systems comply with all identified requirements based on the latest edition 
of the Blue Book. Although the Blue Book is an extensive compilation of 
requirements, it does not necessarily include all Federal requirements. DoD 
Components should use the Blue Book as a tool in determining compliance, but 
are also responsible for knowing all laws and regulations applicable to their 
systems, which may not be included in the Blue Book. Therefore, DoD 
Components should certify compliance based on the applicable requirements 
identified in the latest edition of the Blue Book and other relevant requirements 
as necessary. Also, certification of the application system alone does not 
consider erroneous data streams from feeder systems, or systems controls 
external to the application. Without standardized language identifying the scope 
of the certification, DoD Components may certify that the application software 
is compliant as a stand-alone system and not in an installed or integrated 
environment. 

Sufficiency of Guidance. The USD (C) had not established adequate guidance 
for defining what constitutes a critical system. In addition, the Blue Book does 
not reference sufficient criteria to ensure an adequate financial management 
system review is performed. Also, the DoD Compliance Process incorrectly 
links compliance with Federal financial management systems requirements to 
JFMIP approved software. Adequate guidance should be provided for the DoD 
Compliance Process to be successful. 
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Critical Definition. The DoD Compliance Process definition of a 
critical financial management system remains unclear. The DoD Compliance 
Process conceptually defines a critical financial management system as 
providing information that is materially important to entity-wide financial 
management, control and reporting. Criticality is based on the concept that a 
system provides information that is important in producing reliable financial 
reports, ensuring that the DoD missions are met, or assisting decision makers. 
The DoD Compliance Process states that ascertaining the criticality of a system 
is somewhat judgmental; therefore, it provides a materiality definition. For a 
financial statement line item that is greater than, or equal to, 3 percent of total 
entity assets, the reporting entity shall deem critical any system that is the 
source of values equal to, or greater than, 10 percent of the total amount 
reported on the applicable financial statement line item. This materiality 
definition is to be used as a mechanism for determining criticality by quantifying 
critical systems to achieve consistency. When defining the criticality of a 
system, there is an uncertainty as to the use of the conceptual or the materiality 
definition. 

The DoD Compliance Process states that the DoD Components shall use the 
materiality definition. However, the Army, Navy, and Air Force stated that not 
all systems on their critical systems list would be considered critical according 
to the materiality definition. For example, a system may be considered critical 
according to the materiality definition. However, a system that provides data to 
the critical system may not meet the materiality definition. Using the materiality 
definition to determine criticality, DoD Components may fail to identify systems 
that could impact the accuracy and reliability of data reported on the financial 
statements. Therefore, systems not deemed critical according to the materiality 
guidance may not be subjected to the DoD Compliance Process. Subsequently, 
OUSD (C) personnel stated that based on the outcome of the DoD enterprise 
architecture efforts, any system providing data to the financial statements should 
be mapped and considered reportable. OUSD (C) should meet collectively with 
DoD Components to clarify the critical definition issues that continue throughout 
the DoD. 

Blue Book. The DoD Compliance Process states that the Blue Book 
shall be the primary guidance that a system is evaluated against prior to entering 
the next phase. Although we did not perform a complete assessment of the Blue 
Book, we did determine that it lacks sufficient guidance to ensure compliance in 
the areas of data standardization and general controls. A DoD Component that 
certifies compliance using the Blue Book requirements may not have performed 
a sufficient review to determine whether its systems substantially meets the 
applicable requirements. 

Data standardization. The Blue Book does not adequately 
reference sufficient guidance to ensure data standardization requirements will be 
assessed for DoD financial management systems. OMB Circular A-127 requires 
that each agency establish and maintain a single, integrated financial 
management system. For a system to be integrated, it must provide standard 
data classifications (definitions and formats) and common processes used for 
similar transactions. An integrated system must also provide a design that 
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eliminates unnecessary duplication of transaction entry. DoD systems often 
require duplicative reentry, crosswalks, and manual workarounds. Although the 
Blue Book cites OMB Circular A-127, it is not likely that system owners will 
perform a sufficient review unless more definitive requirements are detailed in 
the Blue Book. The Blue Book should clearly define standard data 
classifications, common processes, and unnecessary duplication to ensure that 
system owners comply with the requirements. The DoD requested $100 million 
of FY 2002 funds for the USD (C) to develop an enterprise architecture and 
define standard data requirements. DFAS should update the Blue Book to 
reference those standards, once the USD (C) approves the standard data 
requirements. 


General Controls. The Blue Book lacks sufficient and 
comprehensive coverage of general controls. General controls are management 
controls that apply to the overall computer operations of an agency. Examples 
of general controls include, but are not limited to: 

• establishing an overall security program, 

• implementing procedures for changing software, 

• separating duties that could allow unauthorized activity, and 

• establishing controls to monitor use of software. 

Some of those controls are referenced in OMB Circular A-130 and DoD 
Instruction 5200.40 7 . Although the Blue Book cites guidance for some general 
controls, the guidance is minimal and may not ensure that those controls are 
operating effectively and ensuring the reliability of data. The Blue Book should 
provide coverage of general controls to ensure that system owners perform a 
sufficient review and reference the applicable Federal and DoD requirements. 

In addition, some general controls are not under the purview of system owners 
and will require coordination among the DoD Components and OUSD (C). The 
USD (C) is aware of those deficiencies, and DFAS plans to incorporate 
additional general controls in the next version of the Blue Book. However, 
because the USD (C) lacked the authority to effectively implement the DoD 
Compliance Process, DoD Components may still not perform a thorough 
review. 


Compliance of JFMIP Certified Software. The JFMIP publishes the 
Core Financial System Requirements (core requirements) that serve as the basis 
to test commercial financial software. The DoD Compliance Process states that 
any system that is JFMIP approved may be placed in the Compliance phase. 
However, JFMIP personnel stated that approved commercial software does not 
ensure compliance because JFMIP core requirements do not cover all Federal 
financial management systems requirements that may be applicable to a system. 
A DoD Component purchasing commercial software with inventory, property or 
travel functions must meet additional requirements, which are not covered in the 
JFMIP core requirements testing. JFMIP also tests commercial software 
capabilities in an ideal environment and does not test how the commercial 
software is installed. For example, an agency may install a JFMIP approved 


7 DoD Information Technology Security Certification and Accreditation Process, December 30, 1997. 
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system with U.S. Standard General Ledger capability, but may not set up the 
general ledger in compliance with the U.S. Standard General Ledger. In 
addition, JFMIP will test a system’s capability to interface correctly with 
another system; however, once installed, the interface may not be in 
compliance. As a result, DoD may incorrectly certify JFMIP approved systems 
as compliant with Federal financial management systems requirements. DoD 
should modify its guidance to ensure that JFMIP approved systems are installed 
correctly and compliance with requirements is adequately documented. This 
modification should ensure compliance with applicable Federal financial 
management system requirements not covered during JFMIP testing. Until DoD 
modifies its guidance, DoD should not report JFMIP approved software as 
compliant. 

Conclusion 


This report identifies DoD Compliance Process issues that should be addressed 
in the development and implementation of the Authorization Act Compliance 
Process. The DoD Compliance Process goal is to achieve reliable financial 
management information to DoD decision makers in a timely manner and ensure 
compliance with applicable Federal financial management systems requirements. 
However, the USD (C) did not have sufficient authority and should consider 
preparing a DoD issuance to ensure that DoD Components implement the DoD 
Compliance Process. The DoD is also addressing a conglomeration of issues 
that will affect the DoD Compliance Process; therefore, the DoD Compliance 
Process should proceed systematically. Once those initiatives are addressed, the 
DoD Compliance Process can be reevaluated and restructured to be in alignment 
with the outcome. In addition, the USD (C) should implement the mechanisms 
necessary to monitor DoD Components’ progress and should reevaluate the 
guidance to ensure an adequate review of financial management systems. 

Recommendations, Management Comments, and Audit 
Response 


A. We recommend that the Under Secretary of Defense (Comptroller): 

1. Institutionalize the Authorization Act Compliance Process in an 
appropriate DoD issuance in order to provide the Under Secretary of 
Defense (Comptroller) explicit authority to ensure that the Military 
Departments and Defense agencies effectively implement the legislative 
provisions. 

Management Comments. The Acting Deputy Chief Financial Officer, Office 
of the Under Secretary of Defense (Comptroller) concurred and will incorporate 
this recommendation into the revised compliance process upon completion of 
their enterprise architecture efforts. The Acting Deputy also stated that, through 
the use of an independent contractor, it is developing a financial management 
enterprise architecture that will serve as the DoD blueprint for effective 
financial management reform. Because the scope of the enterprise architecture 
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development is agency-wide, he believes the lessons learned from the 
development effort will be substantial. Furthermore, the benefits resulting from 
the enterprise architecture lessons learned justifies a delay in revising the current 
compliance process. The development of the enterprise architecture is expected 
to be completed by February 2003. 

2. Implement a systems database to monitor the progress of the 
Military Departments and Defense agencies and ensure that the Military 
Departments and Defense agencies have access to system information not in 
their purview. 

Management Comments. The Acting Deputy concurred and stated that during 
the initial stages of creating the financial management enterprise architecture, 
the contractor will develop a data repository containing an inventory of financial 
management systems, feeder systems, commercial systems, and their respective 
interfaces through their enterprise architecture efforts. This data repository will 
be used for future DoD financial management systems compliance efforts. 

3. Establish the language and scope for systems to certify 
compliance based on the applicable requirements identified in the latest 
edition of the Defense Finance and Accounting Service, “A Guide to Federal 
Requirements for Financial Management Systems” and other relevant 
requirements. 

Management Comments. The Acting Deputy concurred and will require 
system owners to certify compliance with “all Federal and DoD requirements 
that may be relevant to a particular financial management system” as part of the 
revised compliance process. The revised compliance process will also specify 
that a system owner must consider external data flows and interfaces when 
certifying compliance. 

4. Provide a clear definition of a critical financial management 
system. 

Management Comments. The Acting Deputy partially concurred and stated 
that defining criticality is the responsibility of the Office of Management and 
Budget. However, the Under Secretary of Defense (Comptroller) will work 
with the Office of Management and Budget to develop a more concise definition 
of critical. This definition of critical will be included in the revised compliance 
process. 

Audit Response. Although the Acting Deputy partially concurred with the 
recommendation, their proposed actions satisfy the intent of the 
recommendation. No farther comments are required. 

5. Establish guidance to ensure Joint Financial Management 
Improvement Program approved systems are installed correctly and are 
adequately documented to comply with applicable Federal and DoD 
requirements. 
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Management Comments. The Acting Deptuy concurred and will issue 
commercial off-the-shelf software implementation guidance after the completion 
of the enterprise architecture efforts. The commercial off-the-shelf software 
guidance will include software approved by the Joint Financial Management 
Improvement Program. 

B. We recommend that the Director, Defense Finance and Accounting 
Service amend the Defense Finance and Accounting Service, “A Guide to 
Federal Requirements for Financial Management Systems” to include 
detailed coverage of data standardization and general controls. 

Management Comments. The Director of Systems Integration, Defense 
Finance and Accounting Service, stated that version four of the Defense Finance 
and Accounting Service, “A Guide to Federal Requirements for Financial 
Management Systems” (Blue Book) will reference the DoD Data Dictionary 
System. In addition, future versions of the Blue Book will include approved 
data standards developed through the Under Secretary of Defense (Comptroller) 
enterprise architecture effort. The Defense Finance and Accounting Service 
plans to add additional references to automated systems general controls to 
version four of the Blue Book. Additionally, the Defense Finance and 
Accounting Service is considering developing a supplemental general control 
guide for the Blue Book. 
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Appendix A. Audit Process 

Scope 


Work performed. We evaluated the DoD Compliance Process, established in 
the USD (C) January 5, 2001, memorandum and reviewed its effectiveness of 
achieving compliance with Federal financial management system requirements. 
We reviewed OMB, JFMIP, DoD, and other requirements as applicable to the 
DoD Compliance Process. We conducted a limited review of the Blue Book 
version 3, June 2001, to identify specific areas where the coverage of Federal 
financial management system requirements may be insufficient. However, we 
did not perform a complete assessment of Blue Book coverage of Federal 
financial management system requirements. 

We interviewed personnel from the OUSD (C), Business Policy Directorate on 
the status of work performed for the DoD Compliance Process and other DoD 
financial management initiatives. We also interviewed personnel from the 
Office of the Assistant Secretary of the Army (Financial Management) and the 
Army Audit Agency and obtained information on data mapping and guidance. 
We obtained documentation on Army’s preliminary critical inventory list. We 
met with personnel from the Office of Assistant Secretary of the Navy 
(Financial Management) and the Naval Audit Service and obtained 
documentation on their guidance and process. In addition, we obtained 
information on the status of data mapping, critical inventory list compilation, 
and the implementation of the DoD Compliance Process. 

We interviewed personnel from the Office of Assistant Secretary of the 
Air Force (Financial Management) and the Air Force Audit Agency. We 
obtained documentation on guidance, data mapping, an inventory list that 
included 50 systems, the status of individual systems, and the Air Force 
compliance process. We interviewed personnel from the DFAS, Systems 
Integration Directorate and obtained documentation on critical inventory lists 
which included 23 systems, the DFAS process, and guidance. In addition, we 
obtained information on data mapping. We interviewed DLA personnel and 
obtained documentation on the proposed strategies and information on the 
current status of their implementation of the DoD Compliance Process. 

We selected a sample of 12 ODOs based on DoD reporting requirements, 
ownership of critical systems per the FMIP, and auditor judgment. We 
conducted telephone and e-mail correspondence with a selection of ODOs 
regarding their awareness and whether they had initiated implementation of the 
DoD Compliance Process. Three DoD Intelligence Agencies were included 
among our sample of 12 ODOs. Two agencies were not included in the report 
because the information was classified. For a list of the ODOs outside the DoD 
Intelligence community contacted, see Appendix C. 

Limitations to Scope. We did not review the management control program 
related to the overall audit objective because DoD recognized that the 
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categorization of its financial management systems was a systemic control 
weakness in the FY 2000 Annual Statement of Assurance. The FY 2000 DoD 
Statement of Assurance stated the cause of this problem is that DoD accounting, 
finance, and feeder systems do not fully comply with Federal financial 
management systems requirements. 

General Accounting Office High-Risk Area. The General Accounting Office 
has identified several high-risk areas in the DoD. This report provides coverage 
of the Defense Financial Management high-risk area. 

Methodology 


Use of Computer Processed Data. We did not rely on computer-processed 
data to perform this audit. 

Audit Type, Dates, and Standards. We performed this financial-related audit 
from March 2001 through November 2001 in accordance with generally 
accepted government auditing standards. 

Contacts During the Audit. We visited or contacted individuals and 
organizations within DoD, OMB, and JFMIP. Further details are available 
upon request. 

Prior Coverage 

The General Accounting Office and the Inspector General, DoD, have 
conducted multiple reviews relating to compliance with Federal financial 
management requirements. Unrestricted General Accounting Office reports can 
be accessed on the Internet at http://www.gao.gov . Unrestricted 
Inspector General, DoD, reports can be accessed on the Internet at 
http: //www. dodig.osd.mil/audits/reports . 
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Appendix B. The DoD Compliance Process 


The DoD Compliance Process provides guidance to ensure that critical 
accounting, finance, and feeder systems are compliant with applicable Federal 
financial management systems requirements. Details regarding the five phases 
of the DoD Compliance Process and the applicable Blue Book exit criteria 
follow below. 

Awareness. The Awareness phase promotes acknowledgement and 
participation in the DoD Compliance Process across DoD. A DoD Component 
should map the flow of its financial information from point of original entry to 
its presentation on the annual financial statements. To exit the Awareness 
phase, a DoD Component must identify and prioritize critical accounting, 
finance, and feeder systems and categorize each system by function in 
accordance with the Blue Book. 

Evaluation. The Evaluation phase requires the DoD Component to: 

• define the compliance problem(s), 

• decide the appropriate strategies to overcome the problem(s), and 

• establish a plan to apply the resources to ensure compliance. 

To exit the Evaluation phase, a system owner must determine system 
deficiencies according to the Blue Book and develop a corrective action and 
funding plan to correct each deficiency. 

Renovation. The Renovation phase implements the DoD Component corrective 
action plans and conducts reviews necessary to bring non-compliant systems into 
compliance. To exit the Renovation phase, the DoD Component shall certify 
that the system(s) complies with all identified requirements according to the 
Blue Book. The Council, after receiving certification that corrective actions 
applicable to a system have been implemented, will request the Inspector 
General, DoD, to validate the certification. 

Validation. The Validation phase ensures that system problems are remedied 
and that the system is compliant. Validations, in the form of audits or 
acceptable reviews, will be conducted using a standard methodology 
promulgated by the Inspector General, DoD. To exit the Validation phase, a 
system owner shall obtain validation that the system complies with applicable 
compliance factors according to the Blue Book from: 

• the Inspector General, DoD, 

• a public accounting or consulting firm, or 

• the respective Military Department audit agency. 

Compliance. The DoD Compliance phase ensures that required documentation 
is available and maintained for those systems, business areas, and reporting 
entities that have been determined compliant. 
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Appendix C. Other Defense Organizations Status 
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Appendix D. Report Distribution 


Office of the Secretary of Defense 

Under Secretary of Defense for Acquisition, Technology and Logistics 
Under Secretary of Defense (Comptroller) 

Deputy Chief Financial Officer 
Deputy Comptroller (Program/Budget) 

Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) 


Department of the Army 

Assistant Secretary of the Army (Financial Management and Comptroller) 
Auditor General, Department of the Army 
Inspector General, Department of the Army 


Department of the Navy 

Assistant Secretary of the Navy (Financial Management and Comptroller) 
Assistant Secretary of the Navy (Manpower and Reserve Affairs) 

Naval Inspector General 

Auditor General, Department of the Navy 


Department of the Air Force 

Assistant Secretary of the Air Force (Financial Management and Comptroller) 
Auditor General, Department of the Air Force 
Inspector General, Department of the Air Force 
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Other Defense Organizations 


Director, 

Director, 

Director, 

Director, 

Director, 

Director, 

Director, 

Director, 

Director, 

Director, 

Director, 

Director, 


Defense Advanced Research Projects Agency 
Defense Commissary Agency 
Defense Contract Management Agency 
Defense Finance and Accounting Service 
Defense Information Systems Agency 
Defense Logistics Agency 
Defense Security Cooperation Agency 
Defense Threat Reduction Agency 
DoD Human Resources Activity 
Missile Defense Agency 
National Imagery and Mapping Agency 
Washington Headquarters Service 


Non-Defense Federal Organization 

Office of Management and Budget 

Congressional Committees and Subcommittees, Chairman and 
Ranking Minority Member 

Senate Committee on Appropriations 

Senate Subcommittee on Defense, Committee on Appropriations 
Senate Committee on Armed Services 
Senate Committee on Governmental Affairs 
House Committee on Appropriations 

House Subcommittee on Defense, Committee on Appropriations 
House Committee on Armed Services 
House Committee on Government Reform 

House Subcommittee on Government Efficiency, Financial Management, and 
Intergovernmental Relations, Committee on Government Reform 
House Subcommittee on National Security, Veterans Affairs, and International 
Relations, Committee on Government Reform 
House Subcommittee on Technology and Procurement Policy, Committee on 
Government Reform 
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Under Secretary of Defense (Comptroller) 
Comments 



COMPTROLLER 


OFFICE OF THE UNDER SECRETARY OF DEFENSE 
1 lOO DEFENSE PENTAGON 
WASHINGTON. DC 20301-1100 


JAN I 0 2002 


MEMORANDUM FOR ACTING DEPUTY ASSISTANT INSPECTOR GENERAL FOR 
AUDITING 

SUBJECT: Draft Audit Report, “Audit of DoD Financial and Feeder Systems Compliance 
Process” [Project No. D2001FG-0085, December 7, 2001] 


This responds to your transmittal memorandum for the subject draft audit report in which 
you requested comments concerning recommendations A. 1,2,3,4, and 5 presented in the draft 
report. The Department of Defense’s forthcoming financial management enterprise architecture 
will be the basis for detailed actions and milestones for our financial management modernization 
efforts and future initiatives. The comments to the recommendations in the draft report are 
attached. 

This office’s point of contact for this matter is Mr. David Alekson. He may be reached 
by e-mail: aleksond@osd.pentagon.mil or by telephone at (703) 692-5004. 


De 

Acting Deputy Chief Financial Officer 



Attachment 
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OFFICE OF THE INSPECTOR GENERAL DRAFT AUDIT REPORT 
“AUDIT OF DoD FINANCIAL AND FEEDER SYSTEMS COMPLIANCE PROCESS” 
DATED DECEMBER 7,2001 
(PROJECT NO. D-2001FG-0085) 

***** 

OFFICE OF THE UNDER SECRETARY OF DEFENSE (COMPTROLLER) 

AND 

DEFENSE FINANCE AND ACCOUNTING SERVICE 
COMMENTS ON RECOMMENDATIONS 

***** 

Recommendation A.l : That the Under Secretary of Defense (Comptroller) institutionalize the 
S.1438 compliance process in an appropriate DoD issuance in order to provide the Under 
Secretary of Defense (Comptroller) explicit authority to ensure that the Military Departments and 
Defense agencies effectively implement the legislative provisions. 

OUSD(C) Comments : We concur. To help ensure the implementation of financial 
management systems that comply with applicable statutory requirements, the Office of the Under 
Secretary of Defense (Comptroller) OUSD(C)--through the use of an independent contractor-is 
developing a financial management enterprise architecture that will serve as the Department’s 
“blueprint” for effective financial management reform. The enterprise architecture will include 
an “as is” financial management systems inventory (much of which has already been developed 
by OUSD(C) personnel) and environment, a “to be” environment of future systems, and a 
transition plan with defined milestones and actions for achieving the ultimate “to be” 
environment. The President’s budget for fiscal year 2002 includes $100 million for the 
development of the financial management enterprise architecture. The development of the 
enterprise architecture is expected to be complete by February 2003. 

The current instruction for the financial and feeder system compliance process will be revised to 
be consistent with the results of the enterprise architecture and to comply with S.1423. Because 
the scope for the development of the enterprise architecture is agency-wide, we believe the 
lessons that will be learned from the development effort will be substantial. The possibility of 
gaining substantial benefits from any lessons learned in such an all-encompassing development 
effort justifies a delay in revising the current compliance process. Thus, the compliance process 
policy will be formalized to comply with S.1438 and the recommendation in the draft audit 
report when the financial management enterprise architecture is finished—by approximately 
February 2003. 

Recommendation A.2 : That the Under Secretary of Defense (Comptroller) implement a 
systems database to monitor the progress of the Military Departments and Defense agencies and 
ensure the Military Departments and Defense agencies have access to system information not in 
their purview. 
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OUSD(C) Comments : We concur. During the initial stages of creating the financial 
management enterprise architecture, the contractor will develop an inventory that identifies all 
financial management systems, business (feeder) systems, and contractor and commercial 
systems which may be pertinent to the creation of the enterprise architecture. The inventory will 
also identify interrelationships (e.g., interfaces) between systems and the compliance status of 
the systems in the inventory. The inventory information will be housed in a data repository that 
can be used for modeling and simulating focused architectural views. All DoD components and 
agencies will have access to the repository and its associated modeling tool sets. The data 
repository will be the database of record for future efforts to make DoD financial management 
systems compliant. 

Recommendation A.3 : That the Under Secretary of Defense (Comptroller) establish the 
language and scope for systems to certify compliance based on the applicable requirements 
identified in the latest edition of the Defense Finance and Accounting Service’ “A Guide to 
Federal Requirements for Financial Management Systems” 

OUSD(C) Comments : We concur. The Comptroller recognizes the ambiguities inherent in the 
current guidance regarding the compliance process. Future guidance will specify that systems 
will be certified only when they incorporate all Federal and DoD requirements that may be 
relevant to a particular financial management system - regardless of whether those requirements 
are found in the Bluebook or are located elsewhere. Additionally, the revised guidance will 
indicate that any certification of compliance must consider and remark upon feeder systems and 
data flows externa! to the specific systems application being reviewed for compliance. Revised 
guidance for certification will be published upon completion of the financial management 
enterprise architecture. 

Recommendation A.4 : That the Under Secretary of Defense (Comptroller) provide a clear 
definition of a critical financial management system. 

OUSD(C) Comments : We partially concur. The definitive classifier of what constitutes a 
critical financial management system should be the Office of Management and Budget (OMB). 

In the past, OMB has not provided a clear and concise definition of “criticality” with regard to 
financial management systems. According, DoD has developed its own definition. We 
recognize the ambiguities in the current DoD definition and will work with OMB to establish a 
more concise description of a critical financial management system. We will include an 
amended definition in the next version of the DoD Financial and Feeder Compliance Process . 

Recommendation A.5 : That the Under Secretary of Defense (Comptroller) establish guidance 
to ensure that Joint Financial Management Improvement Program approved systems are installed 
correctly and are adequately documented to comply with applicable Federal and DoD 
requirements. 

OUSD(C) Comments : We concur. As stated, we will issue revised formal guidance regarding 
the financial and feeder systems compliance process upon completion of the financial 
management enterprise architecture. At that time, we will also disseminate guidance that 
discusses the implementation of Commercial Off the Shelf Software, including software that has 
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been approved by the Joint Financial Management Improvement Program. The publication of 
revised guidance pertaining to the compliance process for financial management systems will be 
postponed until the development of the financial management enterprise architecture. We hope 
to update and improve all guidance pertaining to the compliance process by using any lessons 
that can be learned from the development of the enterprise architecture. 
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Defense Finance and Accounting Service 
Comments 



DEFENSE FINANCE AND ACCOUNTING SERVICE 


1931 JEFFERSON DAVIS HIGHWAY 
ARLINGTON, VA 22240-5291 


JAN - 9 2002 


MEMORANDUM FOR DIRECTOR, FINANCE AND ACCOUNTING DIRECTORATE, 
OFFICE OF THE INSPECTOR GENERAL, DoD 

SUBJECT: Audit Report on DoD Financial and Feeder Systems Compliance Process (Project 
No. D2001FG-0085) 


The draft report on the subject audit, dated December 7, 2001, contains one 
recommendation for the Defense Finance and Accounting Service (DFAS). This 
recommendation reads, “We recommend that the Director, Defense Finance and Accounting 
Service amend the Defense Finance and Accounting Service, ‘A Guide to Federal Requirements 
for Financial Management Systems’ [Blue Book] to include detailed coverage of data 
standardization and general controls.” 

The most current version (v.3) of the Blue Book references the Standard Fiscal Code. 

The next version (v.4) will reference the DoD Data Dictionary System. Additionally, we will 
amend future versions of the Blue Book to reference compliance with any approved data 
standards developed by the Financial Management Enterprise Architecture effort. 

As stated in the audit report, we are planning to incorporate additional references to 
automated systems general controls in the next version (v.4) of the Blue Book. For this, we will 
research the references listed in DFAS 8000.1 (DFAS Information Assurance Policy), Part G, 
Chapter 1, Paragraph 6, which includes OMB Circular A-130 and DoD instruction 5200.40. We 
are also assessing the possibility of developing a companion guide to the Blue Book covering 
general controls. 

Thank you for the opportunity to comment on this draft audit report. The DFAS point of 
contact for this is Lt Col T. Michael Trout, telephone 703-607-5069, e-mail 
theodore.trout@dfas.mil. 


Kathleen D. Noe 
Director, Systems Integration 
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